1. A Real-world Exploration of BC and DR Audit
Digging Deep:
A Real-world Exploration of BC and DR Audit

2. Agenda BC from a C-Level perspective
Why is important to conduct BC Audits?
Real Case Study (Retail Global Company)
Audit Planning
Audit Methodology
Risks, Controls and Audit Procedures
Conclusion

3. Business Continuity from a C-Level perspective
Source:

4. Source:

5. Source:

6. Source:

7. Source:

8. Why is important to conduct BC Audits?
Source:

9. Ensure that Business Continuity Program is “LIVE”.
Validate if the plans are accurate and working to respond the scenarios identified as critical for business.
Ensure that session training and awareness are performed involving all BC Program stakeholders.
Ensure compliance with standards, best practices, corporate local policies.
Source:

10. Phase I Phase II Phase III Phase IV
Process Improvement
Phase I
Phase II
Phase III
Phase IV
Framework
Assessment
Development
Implementation
Project Administration
Gap Analysis with good practices
Training
Risk Analysis
Business Continuity Strategy Development
BCM Policies
Audit, Exercises, Tests & Workshops
Business Impact Analysis
Documentation of Business Continuity Plans
BCM Program Management
Maintenance and Improvement
Audit Continuous Program must become part of Organization

11. Real Case Study (Retail Global Company)
Source:

12. Audit Planning
The objective was to review of Brazil’s Business Continuity plans to provide management an objective assessment of whether sufficient controls exist to ensure good practices, policies and procedures were in place throughout the company.
Audit scope covered the review of key controls for high risks identified in the following processes:
1) Secure Information Repository 4) BC Plans
2) Risk Assessment 5) Training and Awareness
3) Business Impact Analysis 6) Exercises and Tests

13. Out of Audit Scope:
BC program (objective, scope, framework) and policy
Roles and Responsibilities
Budget and Resource Allocation
3rd Party Analysis
Emergency and Crisis Procedures
Post Incident Review
Metrics and Indicators
Management Review
Date: 2013
Criteria: Business Continuity Global Policy
Period: 1 year before
Sample: Non-statistical

14. Business areas involved
Asset Protection
Legal
Compliance
Logistics
Communication
Merchandising
Finance
Replenishment
Ethics
People
Information Technology
Operations Store

15. Audit Methodology

16. Focus on high-risk areas Integrated with IT Audit
Team approach and on going assessment of strategy
Continuous communication with Auditee
Draft Report
Opening Meeting
Finalize Scope
Fieldwork (Perform)
Planning
Process Risk Analysis
Conduct interviews/obtain understanding of processes and flowchart processes and associated risks.
Evaluate control strengths and weaknesses
Scope Definition:
Includes consideration of relevant processes, systems, records, personnel, and physical properties, including those under the control of third parties.
Focus on indentifying inherent high risk exposure
Follow-up (FUP)
Assess that actions to mitigate the risk exposure observed in Internal Audit reviews are timely and effectively implemented.
Provide CEO/CFO scorecards with the status of action plans and upcoming or past-due implementation dates.
Draft Project Scope
Findings
Test selected key controls
Develop and execute unique test plans and communicate test results to customer
Hold “In-Fact“ Meeting
Discuss audit observation and test results and reach consensus on cause and impact and recommend corrective action
Interim Communications
Findings

17. Example Risks, Controls and Audit Procedures
1) Secure Information Repository
Risk
Control (Expected)
Documentation illegibility
There are automated controls implemented to keep the documentation (BCPs, DR, Risk Assessments, BIAs, Training, Tests results, presentations, meeting notes), including distribution, access, storage and preservation, retrieval, control of changes, preservation of legibility, prevention of the unintended use of obsolete information, retention and disposal procedures
Leakage of restricted information
Use of obsolete information
Information theft

18. Example Risks, Controls and Audit Procedures
1) Secure Information Repository
Audit Procedure
Schedule a visit in loco to verify if automated control implemented is a secure repository solution to keep the BC documentation including but not limited to:
a) Distribution and Access Control;
b) Control of Changes;
c) Preservation of legibility and retrieval;
d) Prevention of the unintended use of obsolete information
e) Retention and disposal period established.
Obtain print-screens of automated tool and formal procedures to ensure that the controls above are implemented.

19. Example Risks, Controls and Audit Procedures 2) Risk Assessment Risk
Control (Expected)
Not knowlegement and management of disruption risks
There is a formal and documented risk assessment process to identify risks of disruption to business functions and resources, systematically analyze risk, evaluate which disruption related risks require treatment, and identify treatments commensurate with emergency management and recovery objectives in accordance with company risk appetite.
Risk assessment in disaccording with company risk appetite and recovery objectives.
Inappropriate risk treatment and follow up management.

20. Example Risks, Controls and Audit Procedures 2) Risk Assessment
1) Obtain the Risk Assessment methodology and quality/quantity criteria based on.
2) Obtain the last Risk Assessment report.
3) Obtain the Meeting Notes about the Risk Assessment results presentation to Executive Board.
4) Verify if Risk Assessment is according to BC global policy and it includes:
a) threats to and vulnerabilities (risks evaluated) that could lead a disruption to critical business functions and resources.
b) impacts that would arise if an identified threat becomes an incident and causes a business disruption.
c) risks treatments and actions plans for each threats and vulnerability commensurate with emergency management and recovery objectives in accordance with company risk appetite.

21. Example Risks, Controls and Audit Procedures
3) Business Impact Analysis
Risk
Control (Expected)
Documentation illegibility
There is a formal and implemented methodology and questionnaires for determining continuity and recovery priorities, objectives and targets.
The BIA report include:
i. Critical business functions and resources that support the execution of business processes, assessing the impacts over time of not performing these functions
ii. Prioritized timeframes for resuming these activities at a specified minimum acceptable level, taking into consideration the time within which the impacts of not resuming them would become unacceptable
Leakage of restricted information
Use of obsolete information

22. Example Risks, Controls and Audit Procedures
3) Business Impact Analysis
Audit Procedure
1) Obtain the last version of BIA methodology approved by executive management including criteria used to quantify and qualify the customer, financial, regulatory, operational, reputational and human impacts.
2) Obtain the BIA questionnaires used on the last year for each business area interviewed and the final report of results.
3) Obtain the meeting notes about the BIA results presentation to Executive Board on the last year.

23. Example Risks, Controls and Audit Procedures
3) Business Impact Analysis
Audit Procedure
4) Analyze if BIA documentation is according to BC global policy and it includes, but not limited to:
a) impacts of disruption activities that support in-scope business process, key products, IT systems and services.
b) business functions and resources that support the execution of business process and IT systems, assessing the impacts over time of not performing.
c) timeframes for resuming the business functions at a specified minimum acceptable level, taking into consideration the time period after the start of a disruption within which each activity needs to be resumed been identified.
d) RTO and RPO for each process.
e) all interdependencies relevant to the critical functions, activities or IT systems.
f) suppliers and outsource on whom critical functions or activities depend.
g) minimum resources (people, technology, physical space, equipment, records).

24. Example Risks, Controls and Audit Procedures
4) Business Continuity Plans
Risk
Control (Expected)
Business disruption
There is a business Brazil unit continuity strategies options (with selection influenced by a cost-benefit analysis) and plans in place to enable recovery based on the outputs from the BIA and risk assessment.
In addition, there is strategy to make available the IT services upon which business activities depend. Solutions are required which ensure the availability of applications within specific timeframes. Technology platforms and application software are in place within timescales. Data continuity solution is designed to meet management-approved Recovery Point Objectives (RPO).
Unavailability of IT environment and IT processing services
Damage to the company’s image.
Customer dissatisfaction
Compromise the ability to completely and timely recover the business operations.

25. Example Risks, Controls and Audit Procedures
4) Business Continuity Plans
Audit Procedure
1) Obtain the last version of Business Brazil Unit Continuity Plans.
2) Verify if BC Plans include the recovery strategies (Data Center, Call Center, DCs, People site) options selected after the cost-benefit analysis and based on the outputs from BIA and Risk Assessment results, in order to Protect prioritized functions, stabilize, continue, resume and recover prioritized functions and their dependencies and resources, and mitigate, respond to and manage impacts.
3) Verify if DR IT Plan includes but are not limited to:
a) Strategy determinations reviewed and updated after major technology changes
b) Infrastructure and application-oriented plans with procedures focused on the recovery information technology assets, based on management approved IT disaster recovery strategies

26. Example Risks, Controls and Audit Procedures
4) Business Continuity Plans
Audit Procedure
4) Verify if Business Unit Continuity Plans include:
a) Purpose, objectives and scope.
b) Primary and second owner and it´s roles/responsibilities.
c) Activation criteria and procedures.
d) Communication requirements and procedures.
e) Internal and external interdependencies and interactions.
f) Resource requirements.
g) Information flow and documentation process.
h) Functions that must be maintained.
i) Critical and time-sensitive applications.
j) Alternative work people sites address.
l) Vital records.
m) Contact lists of critical suppliers and BC recovery teams.
n) Recovery standard procedures (IT environment or/and Manual Workaround).

27. Example Risks, Controls and Audit Procedures 5) Training and Awareness
Control (Expected)
Perform inadequate activities to respond during an event.
There is a BC training and awareness program implemented. The goal is to create awareness and enhance the knowledge, skills, and abilities required to implement, support, and maintain the program. The scope and frequency of instruction is identified. All employees are trained to the level of their involvement and apply to simple test/exam at the end of each session training.
Records of training and education are maintained in a secure repository.
Inability to measure the effectiveness training activities in place.

28. Example Risks, Controls and Audit Procedures 5) Training and Awareness
1) Obtain the training and awareness Program.
2) Verify if training program include but are not limited to:
a) Identify stakeholder groups with associated training / awareness needs.
b) Management-approve training / awareness methods, tools and materials.
c) Execute and schedule frequents training / awareness activities and content.
3) Obtain the BC sessions training attendance list of last year including the registers of all staff according to audience described in the program document.
4) Obtain the tests/exams results completed by attendance list.

29. Example Risks, Controls and Audit Procedures 6) Exercises and Tests
Control (Expected)
BC Plans do not work during a real-scenario/crisis.
There are an exercise/test procedures and strategies consistent with BC global policy objectives. Exercises and table tops are designed to evaluate plans, procedures, and capabilities and they are based on appropriate scenarios (with defined aims and objectives).
There are formalized post-exercise reports reviewed within the context of promoting continual improvement.
At a minimum, an annual simulation and tabletop exercise are conducted for the business continuity plans and IT DR plan.
Inability to promoting continual improvement without lessons learned.

30. Example Risks, Controls and Audit Procedures 6) Exercises and Tests
1) Obtain the exercises and tests program and procedures and verify if include but are not limited to:
a) Exercise plans and materials, consistent with the scope of the program
b) Scheduled, executed exercise sessions*, consistent with the scope of the program
c) Exercise summary reporting, consistent with the scope of the program
d) Post-incident reporting documenting the activation of plans and corrective actions.
2) Obtain the version of last annual simulation and tabletop exercise report conducted with the business continuity leaders and meeting notes of presentation of summary results to executive management team.

31. Conclusion
Management should take immediate actions to strengthen controls surrounding Business Continuity Plans. The deficiencies noted increased the exposure to unavailability of the IT environment and consequently a business interruption, which could ultimately lead to competitive disadvantage and damage to the company’s public image.
Overall Report Rating:
Unsatisfactory - Require immediate management action to address significant issues identified to mitigate risks to appropriate levels for the business.

32. Business Continuity and Emergency Management always was part of company’s culture.
The founder laid the ground work for the principles that still guide the way the company responds to a crisis of any type.
•Associates
•Operations
•Community
“Take care of your associates, and they will take care of your operation, and the operation will take care of the community.”

33. Send me your questions !!

34. What happened after the global audit program?
Question:
What happened after the global audit program?
Until 2014 the enterprise continuity team has completed around the World:
225 BIAs
218 Business Continuity Plans through global BC program
Awareness and sessions training programs
Different BC exercises with operational and crisis team

35. Thank you !!! Contacts: Silvio Pezzo @pezzosi1 silvio.pezzo@br.ey.com
São Paulo, Brazil